Source address translation in overlay networks

ABSTRACT

Systems, methods, and non-transitory computer-readable storage media for translating source addresses in an overlay network. An access switch in an overlay network, such as a VXLAN, may receive an encapsulated packet from a tunnel endpoint in the overlay network. The encapsulated packet may originate from a host associated with the tunnel endpoint and be encapsulated at the tunnel endpoint with a first source tunnel endpoint address and a destination tunnel endpoint address. The access switch may replace the first source tunnel endpoint address in the encapsulated packet with a second source tunnel endpoint address of the access switch to yield a translated packet. The access switch may then transmit the translated packet towards the destination tunnel endpoint address.

RELATED APPLICATIONS

This application claims priority to U.S. Provisional Patent ApplicationNo. 61/900,333, filed Nov. 5, 2013, the content of which is incorporatedherein by reference in its entirety.

TECHNICAL FIELD

The present technology pertains to overlay networks, and morespecifically pertains to address translations in overlay networks.

BACKGROUND

Overlay network technologies, such as Virtual Extensible Local AreaNetworks (VXLANs), offer a highly scalable solution to managing cloudcomputing deployments by allowing OSI layer 2 networks to expand beyondlayer 3 network boundaries through network virtualization. Layer 2 datatraffic, such as Media Access Control (MAC) Ethernet frames, can beencapsulated within layer 3 packets, such as User Datagram Protocol(UDP) packets, to travel across layer 3 boundaries to reach itsdestination within the overlay network.

Various tunnel endpoints within the overlay network, such as VirtualTunnel Endpoints (VTEPs), can terminate overlay network packets byencapsulating and de-encapsulating packets through MAC-to-UDPencapsulation. Each tunnel endpoint may be provided with a unique IP/MACaddress pair to make the encapsulation and routing encapsulated packetswithin the overlay network possible. In addition, all the tunnelendpoint IP addresses in the overlay network may need to be stored inlookup tables at every one of those tunnel endpoints so that thosetunnel endpoints can determine where to transmit encapsulated traffic.However, as the number of tunnel endpoints in a given overlay networkincreases, these tables also need to scale linearly, which can consume alarge amount of resources at the tunnel endpoints.

Maintaining a large number of lookup or routing tables can be achallenge when new endpoints, such as servers and virtual machines(VMs), are added to the overlay network, existing endpoints are removedfrom the network, or some of the endpoints migrate from one tunnelendpoint to another within the network. Whenever such changes occur inthe network topology, many if not all lookup tables residing in tunnelendpoints throughout the overlay network may require an update, amodification, or a synchronization. This can pose a great challengeparticularly in a large cloud computing environment where there arenumerous virtual domains, virtual networks, and endpoints.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to describe the manner in which the above-recited and otheradvantages and features of the disclosure can be obtained, a moreparticular description of the principles briefly described above will berendered by reference to specific embodiments thereof which areillustrated in the appended drawings. Understanding that these drawingsdepict only example embodiments of the disclosure and are not thereforeto be considered to be limiting of its scope, the principles herein aredescribed and explained with additional specificity and detail throughthe use of the accompanying drawings in which:

FIG. 1 illustrates an example network device according to some aspectsof the subject technology;

FIGS. 2A-B illustrate example system embodiments according to someaspects of the subject technology;

FIG. 3 illustrates a schematic block diagram of an example architecturefor a network fabric;

FIG. 4 illustrates an example overlay network;

FIG. 5 illustrates an example layout of an encapsulated packet;

FIG. 6 illustrates a schematic block diagram of an example overlaynetwork with access switches functioning as proxies for tunnelendpoints;

FIG. 7 illustrates an example encapsulation table;

FIG. 8 illustrates a schematic block diagram of an example overlaynetwork with source address translation;

FIGS. 9A-C illustrate source address translation in an exampleencapsulated packet;

FIG. 10 illustrates an example method embodiment; and

FIG. 11 illustrates another example method embodiment.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Various embodiments of the disclosure are discussed in detail below.While specific implementations are discussed, it should be understoodthat this is done for illustration purposes only. A person skilled inthe relevant art will recognize that other components and configurationsmay be used without parting from the spirit and scope of the disclosure.

Overview

Systems, methods, and computer-readable storage devices are disclosedwhich address the issues raised above regarding storing tunnel endpointaddresses in lookup tables. According to the various embodimentsdisclosed herein, an access switch in an overlay network can receive anencapsulated packet from a tunnel endpoint in the same overlay network.The encapsulated packet may have originated from a host behind thetunnel endpoint. The packet may have been encapsulated at the tunnelendpoint with a source tunnel endpoint address of the tunnel endpointand a destination tunnel endpoint address.

The access switch can translate the encapsulated packet and its sourcetunnel endpoint address by replacing the source tunnel endpoint addressin the encapsulated packet with the tunnel endpoint address of theaccess switch. Subsequently, the access switch may transmit thetranslated packet towards the destination tunnel endpoint address.

The proposed methods use the access switch to proxy for tunnel endpointsthat are below it, such that only the tunnel endpoint address of theaccess switch would need to be stored at other tunnel endpoints' lookuptables. These methods may advantageously reduce the number ofencapsulation information needed at tunnel endpoints, reduce the amountof host movements updates needed at tunnel endpoints, and can beimplemented in access switch hardware with low hardware cost.

Description

A computer network is a geographically distributed collection of nodesinterconnected by communication links and segments for transporting databetween endpoints, such as personal computers and workstations. Manytypes of networks are available, with the types ranging from local areanetworks (LANs) and wide area networks (WANs) to overlay andsoftware-defined networks, such as virtual extensible local areanetworks (VXLANs).

LANs typically connect nodes over dedicated private communications linkslocated in the same general physical location, such as a building orcampus. WANs, on the other hand, typically connect geographicallydispersed nodes over long-distance communications links, such as commoncarrier telephone lines, optical lightpaths, synchronous opticalnetworks (SONET), or synchronous digital hierarchy (SDH) links. LANs andWANs can include layer 2 (L2) and/or layer 3 (L3) networks and devices.

The Internet is an example of a WAN that connects disparate networksthroughout the world, providing global communication between nodes onvarious networks. The nodes typically communicate over the network byexchanging discrete frames or packets of data according to predefinedprotocols, such as the Transmission Control Protocol/Internet Protocol(TCP/IP). In this context, a protocol can refer to a set of rulesdefining how the nodes interact with each other. Computer networks maybe further interconnected by an intermediate network node, such as arouter, to extend the effective “size” of each network.

Overlay networks generally allow virtual networks to be created andlayered over a physical network infrastructure. Overlay networkprotocols, such as Virtual Extensible LAN (VXLAN), NetworkVirtualization using Generic Routing Encapsulation (NVGRE), NetworkVirtualization Overlays (NVO3), and Stateless Transport Tunneling (STT),provide a traffic encapsulation scheme which allows network traffic tobe carried across L2 and L3 networks over a logical tunnel. Such logicaltunnels can be originated and terminated through virtual tunnel endpoints (VTEPs).

Moreover, overlay networks can include virtual segments, such as VXLANsegments in a VXLAN overlay network, which can include virtual L2 and/orL3 overlay networks over which VMs communicate. The virtual segments canbe identified through a virtual network identifier (VNI), such as aVXLAN network identifier, which can specifically identify an associatedvirtual segment or domain.

Network virtualization allows hardware and software resources to becombined in a virtual network. For example, network virtualization canallow multiple numbers of VMs to be attached to the physical network viarespective virtual LANs (VLANs). The VMs can be grouped according totheir respective VLAN, and can communicate with other VMs as well asother devices on the internal or external network.

Network segments, such as physical or virtual segments; networks;devices; ports; physical or logical links; and/or traffic in general canbe grouped into a bridge or flood domain. A bridge domain or flooddomain can represent a broadcast domain, such as an L2 broadcast domain.A bridge domain or flood domain can include a single subnet, but canalso include multiple subnets. Moreover, a bridge domain can beassociated with a bridge domain interface on a network device, such as aswitch. A bridge domain interface can be a logical interface whichsupports traffic between an L2 bridged network and an L3 routed network.In addition, a bridge domain interface can support internet protocol(IP) termination, VPN termination, address resolution handling, MACaddressing, etc. Both bridge domains and bridge domain interfaces can beidentified by a same index or identifier.

Furthermore, endpoint groups (EPGs) can be used in a network for mappingapplications to the network. In particular, EPGs can use a grouping ofapplication endpoints in a network to apply connectivity and policy tothe group of applications. EPGs can act as a container for buckets orcollections of applications, or application components, and tiers forimplementing forwarding and policy logic. EPGs also allow separation ofnetwork policy, security, and forwarding from addressing by insteadusing logical application boundaries.

Cloud computing can also be provided in one or more networks to providecomputing services using shared resources. Cloud computing can generallyinclude Internet-based computing in which computing resources aredynamically provisioned and allocated to client or user computers orother devices on-demand, from a collection of resources available viathe network (e.g., “the cloud”). Cloud computing resources, for example,can include any type of resource, such as computing, storage, andnetwork devices, virtual machines (VMs), etc. For instance, resourcesmay include service devices (firewalls, deep packet inspectors, trafficmonitors, load balancers, etc.), compute/processing devices (servers,CPU's, memory, brute force processing capability), storage devices(e.g., network attached storages, storage area network devices), etc. Inaddition, such resources may be used to support virtual networks,virtual machines (VM), databases, applications (Apps), etc.

Cloud computing resources may include a “private cloud,” a “publiccloud,” and/or a “hybrid cloud.” A “hybrid cloud” can be a cloudinfrastructure composed of two or more clouds that inter-operate orfederate through technology. In essence, a hybrid cloud is aninteraction between private and public clouds where a private cloudjoins a public cloud and utilizes public cloud resources in a secure andscalable manner. Cloud computing resources can also be provisioned viavirtual networks in an overlay network, such as a VXLAN.

The disclosed technology addresses the need in the art for translatingtunnel endpoint addresses in overlay networks. Disclosed are systems,methods, and computer-readable storage media for receiving anencapsulated packet from a tunnel endpoint, translating the encapsulatedpacket and its tunnel endpoint address, and replacing transmitting thetranslated packet to the destination tunnel endpoint. A briefintroductory description of example systems and networks, as illustratedin FIGS. 1 through 4, is disclosed herein. A detailed description ofsource address translation, related concepts, and example variations,will then follow. These variations shall be described herein as thevarious embodiments are set forth. The disclosure now turns to FIG. 1.

FIG. 1 illustrates an example network device 110 suitable forimplementing the present invention. Network device 110 includes mastercentral processing unit (CPU) 162, interfaces 168, and bus 115 (e.g., aPCI bus). When acting under the control of appropriate software orfirmware, CPU 162 is responsible for executing packet management, errordetection, and/or routing functions, such as miscabling detectionfunctions, for example. CPU 162 preferably accomplishes all thesefunctions under the control of software including an operating systemand any appropriate applications software. CPU 162 may include one ormore processors 163 such as a processor from the Motorola family ofmicroprocessors or the MIPS family of microprocessors. In an alternativeembodiment, processor 163 is specially designed hardware for controllingthe operations of router 110. In a specific embodiment, memory 161 (suchas non-volatile RAM and/or ROM) also forms part of CPU 162. However,there are many different ways in which memory could be coupled to thesystem.

Interfaces 168 are typically provided as interface cards (sometimesreferred to as “line cards”). Generally, they control the sending andreceiving of data packets over the network and sometimes support otherperipherals used with the router 110. Among the interfaces that may beprovided are Ethernet interfaces, frame relay interfaces, cableinterfaces, DSL interfaces, token ring interfaces, and the like. Inaddition, various very high-speed interfaces may be provided such asfast token ring interfaces, wireless interfaces, Ethernet interfaces,Gigabit Ethernet interfaces, ATM interfaces, HSSI interfaces, POSinterfaces, FDDI interfaces and the like. Generally, these interfacesmay include ports appropriate for communication with the appropriatemedia. In some cases, they may also include an independent processorand, in some instances, volatile RAM. The independent processors maycontrol such communications intensive tasks as packet switching, mediacontrol and management. By providing separate processors for thecommunications intensive tasks, these interfaces allow mastermicroprocessor 162 to efficiently perform routing computations, networkdiagnostics, security functions, etc.

Although the system shown in FIG. 1 is one specific network device ofthe present invention, it is by no means the only network devicearchitecture on which the present invention can be implemented. Forexample, an architecture having a single processor that handlescommunications as well as routing computations, etc. is often used.Further, other types of interfaces and media could also be used with therouter.

Regardless of the network device's configuration, it may employ one ormore memories or memory modules (including memory 161) configured tostore program instructions for the general-purpose network operationsand mechanisms for roaming, route optimization and routing functionsdescribed herein. The program instructions may control the operation ofan operating system and/or one or more applications, for example. Thememory or memories may also be configured to store tables such asmobility binding, registration, and association tables, etc.

FIG. 2A and FIG. 2B illustrate example system embodiments. The moreappropriate embodiment will be apparent to those of ordinary skill inthe art when practicing the present technology. Persons of ordinaryskill in the art will also readily appreciate that other systemembodiments are possible.

FIG. 2A illustrates a conventional system bus computing systemarchitecture 200 wherein the components of the system are in electricalcommunication with each other using a bus 205. Example system 200includes a processing unit (CPU or processor) 210 and a system bus 205that couples various system components including the system memory 215,such as read only memory (ROM) 220 and random access memory (RAM) 225,to the processor 210. The system 200 can include a cache of high-speedmemory connected directly with, in close proximity to, or integrated aspart of the processor 210. The system 200 can copy data from the memory215 and/or the storage device 230 to the cache 212 for quick access bythe processor 210. In this way, the cache can provide a performanceboost that avoids processor 210 delays while waiting for data. These andother modules can control or be configured to control the processor 210to perform various actions. Other system memory 215 may be available foruse as well. The memory 215 can include multiple different types ofmemory with different performance characteristics. The processor 210 caninclude any general purpose processor and a hardware module or softwaremodule, such as module 1 (232), module 2 (234), and module 3 (236)stored in storage device 230, configured to control the processor 210 aswell as a special-purpose processor where software instructions areincorporated into the actual processor design. The processor 210 mayessentially be a completely self-contained computing system, containingmultiple cores or processors, a bus, memory controller, cache, etc. Amulti-core processor may be symmetric or asymmetric.

To enable user interaction with the computing device 200, an inputdevice 245 can represent any number of input mechanisms, such as amicrophone for speech, a touch-sensitive screen for gesture or graphicalinput, keyboard, mouse, motion input, speech and so forth. An outputdevice 235 can also be one or more of a number of output mechanismsknown to those of skill in the art. In some instances, multimodalsystems can enable a user to provide multiple types of input tocommunicate with the computing device 200. The communications interface240 can generally govern and manage the user input and system output.There is no restriction on operating on any particular hardwarearrangement and therefore the basic features here may easily besubstituted for improved hardware or firmware arrangements as they aredeveloped.

Storage device 230 is a non-volatile memory and can be a hard disk orother types of computer readable media which can store data that areaccessible by a computer, such as magnetic cassettes, flash memorycards, solid state memory devices, digital versatile disks, cartridges,random access memories (RAMs) 225, read only memory (ROM) 220, andhybrids thereof.

The storage device 230 can include software modules 232, 234, 236 forcontrolling the processor 210. Other hardware or software modules arecontemplated. The storage device 230 can be connected to the system bus205. In one aspect, a hardware module that performs a particularfunction can include the software component stored in acomputer-readable medium in connection with the necessary hardwarecomponents, such as the processor 210, bus 205, display 235, and soforth, to carry out the function.

FIG. 2B illustrates a computer system 250 having a chipset architecturethat can be used in executing the described method and generating anddisplaying a graphical user interface (GUI). Computer system 250 is anexample of computer hardware, software, and firmware that can be used toimplement the disclosed technology. System 250 can include a processor255, representative of any number of physically and/or logicallydistinct resources capable of executing software, firmware, and hardwareconfigured to perform identified computations. Processor 255 cancommunicate with a chipset 260 that can control input to and output fromprocessor 255. In this example, chipset 260 outputs information tooutput 265, such as a display, and can read and write information tostorage device 270, which can include magnetic media, and solid statemedia, for example. Chipset 260 can also read data from and write datato RAM 275. A bridge 280 for interfacing with a variety of userinterface components 285 can be provided for interfacing with chipset260. Such user interface components 285 can include a keyboard, amicrophone, touch detection and processing circuitry, a pointing device,such as a mouse, and so on. In general, inputs to system 250 can comefrom any of a variety of sources, machine generated and/or humangenerated.

Chipset 260 can also interface with one or more communication interfaces290 that can have different physical interfaces. Such communicationinterfaces can include interfaces for wired and wireless local areanetworks, for broadband wireless networks, as well as personal areanetworks. Some applications of the methods for generating, displaying,and using the GUI disclosed herein can include receiving ordereddatasets over the physical interface or be generated by the machineitself by processor 255 analyzing data stored in storage 270 or 275.Further, the machine can receive inputs from a user via user interfacecomponents 285 and execute appropriate functions, such as browsingfunctions by interpreting these inputs using processor 255.

It can be appreciated that example systems 200 and 250 can have morethan one processor 210 or be part of a group or cluster of computingdevices networked together to provide greater processing capability.

FIG. 3 illustrates a schematic block diagram of an example architecture300 for a network fabric 312. Network fabric 312 can include spineswitches 302 _(A), 302 _(B), . . . , 302 _(N) (collectively “302”)connected to leaf switches 304 _(A), 304 _(B), 304 _(c), . . . , 304_(N) (collectively “304”) in network fabric 312.

Spine switches 302 can be L3 switches in fabric 312. However, in somecases, spine switches 302 can also, or otherwise, perform L2functionalities. Further, spine switches 302 can support variouscapabilities, such as 40 or 10 Gbps Ethernet speeds. To this end, spineswitches 302 can include one or more 40 Gigabit Ethernet ports. Eachport can also be split to support other speeds. For example, a 40Gigabit Ethernet port can be split into four 10 Gigabit Ethernet ports.

In some embodiments, one or more of spine switches 302 can be configuredto host a proxy function that performs a lookup of the endpoint addressidentifier to locator mapping in a mapping database on behalf of leafswitches 304 that do not have such mapping. The proxy function can dothis by parsing through the packet to the encapsulated, tenant packet toget to the destination locator address of the tenant. Spine switches 302can then perform a lookup of their local mapping database to determinethe correct locator address of the packet and forward the packet to thelocator address without changing certain fields in the header of thepacket.

When a packet is received at spine switch 302 _(i), spine switch 302,can first check if the destination locator address is a proxy address.If so, spine switch 302, can perform the proxy function as previouslymentioned. If not, spine switch 302, can lookup the locator in itsforwarding table and forward the packet accordingly.

Spine switches 302 connect to leaf switches 304 in fabric 312. Leafswitches 304 can include access ports (or non-fabric ports) and fabricports. Fabric ports can provide uplinks to spine switches 302, whileaccess ports can provide connectivity for devices, hosts, endpoints,VMs, or external networks to fabric 312.

Leaf switches 304 can reside at the edge of fabric 312, and can thusrepresent the physical network edge. In some cases, leaf switches 304can be top-of-rack (ToR) switches configured according to a ToRarchitecture. In other cases, leaf switches 304 can be aggregationswitches in any particular topology, such as end-of-row (EoR) ormiddle-of-row (MoR) topologies. The leaf switches 304 can also representaggregation switches, for example. In some embodiments, spine switches302 and leaf switches 304 can be arranged in a Clos network topology. Inother embodiments, spine switches 302 and leaf switches 304 can bearranged in a fat tree network topology.

The leaf switches 304 can be responsible for routing and/or bridging thetenant packets and applying network policies. In some cases, a leafswitch can perform one or more additional functions, such asimplementing a mapping cache, sending packets to the proxy function whenthere is a miss in the cache, encapsulate packets, enforce ingress oregress policies, etc.

Moreover, the leaf switches 304 can contain virtual switchingfunctionalities, such as a virtual tunnel endpoint (VTEP) function asexplained below in the discussion of VTEP 408 in FIG. 4. To this end,leaf switches 304 can connect the fabric 312 to an overlay network, suchas overlay network 400 illustrated in FIG. 4.

Network connectivity in the fabric 312 can flow through the leafswitches 304. Here, the leaf switches 304 can provide servers,resources, endpoints, external networks, or VMs access to the fabric312, and can connect the leaf switches 304 to each other. In some cases,the leaf switches 304 can connect EPGs to the fabric 312 and/or anyexternal networks. Each EPG can connect to the fabric 312 via one of theleaf switches 304, for example.

Endpoints 310A-E (collectively “310”) can connect to the fabric 312 vialeaf switches 304. For example, endpoints 310A and 310B can connectdirectly to leaf switch 304A, which can connect endpoints 310A and 310Bto the fabric 312 and/or any other one of the leaf switches 304.Similarly, endpoint 310E can connect directly to leaf switch 304C, whichcan connect endpoint 310E to the fabric 312 and/or any other of the leafswitches 304. On the other hand, endpoints 310C and 310D can connect toleaf switch 304B via L2 network 306. Similarly, the wide area network(WAN) can connect to the leaf switches 304C or 304D via L3 network 308.

Endpoints 310 can include any communication device, such as a computer,a server, a switch, a router, etc. In some cases, the endpoints 310 caninclude a server, hypervisor, or switch configured with a VTEPfunctionality which connects an overlay network, such as overlay network400 below, with the fabric 312. For example, in some cases, endpoints310 can represent one or more of the VTEPs 408A-D illustrated in FIG. 4.Here, the VTEPs 408A-D can connect to the fabric 312 via the leafswitches 304. The overlay network can host physical devices, such asservers, applications, EPGs, virtual segments, virtual workloads, etc.In addition, the endpoints 310 can host virtual workload(s), clusters,and applications or services, which can connect with the fabric 312 orany other device or network, including an external network. For example,one or more endpoints 310 can host, or connect to, a cluster of loadbalancers or an EPG of various applications.

Although the fabric 312 is illustrated and described herein as anexample leaf-spine architecture, one of ordinary skill in the art willreadily recognize that the subject technology can be implemented basedon any network fabric, including any data center or cloud networkfabric. Indeed, other architectures, designs, infrastructures, andvariations are contemplated herein.

FIG. 4 illustrates an example overlay network 400. Overlay network 400uses an overlay protocol, such as VXLAN, NVGRE, VO3, or STT, toencapsulate traffic in L2 and/or L3 packets which can cross overlay L3boundaries in the network. As illustrated in FIG. 4, overlay network 400can include hosts 406A-D interconnected via network 402.

Network 402 can include a packet network, such as an IP network, forexample. Moreover, network 402 can connect the overlay network 400 withthe fabric 312 in FIG. 3. For example, VTEPs 408A-D can connect with theleaf switches 304 in the fabric 312 via network 402.

Hosts 406A-D include virtual tunnel end points (VTEP) 408A-D, which canbe virtual nodes or switches configured to encapsulate andde-encapsulate data traffic according to a specific overlay protocol ofthe network 400, for the various virtual network identifiers (VNIDs)410A-I. Each host 406A-D can be a Virtual Ethernet Module (VEM) that isassigned at least one IP address used as the source IP address when theencapsulated MAC frames are sent to other VEMs over the network.Moreover, hosts 406A-D can include servers containing a VTEPfunctionality, hypervisors, and physical switches, such as L3 switches,configured with a VTEP functionality. For example, hosts 406A and 406Bcan be physical switches configured to run VTEPs 408A-B. Here, hosts406A and 406B can be connected to servers 404A-D, which, in some cases,can include virtual workloads through VMs loaded on the servers, forexample.

In some embodiments, network 400 can be a VXLAN network, and VTEPs408A-D can be VXLAN tunnel end points. However, as one of ordinary skillin the art will readily recognize, network 400 can represent any type ofoverlay or software-defined network, such as NVGRE, STT, or even overlaytechnologies yet to be invented.

The VNIDs can represent the segregated virtual networks in overlaynetwork 400. In some embodiments where network 400 may be a VXLANnetwork, VNIDs can be VXLAN IDs that are used to segment and identifyvirtual networks. Each of the overlay tunnels (VTEPs 408A-D) can includeone or more VNIDs. For example, VTEP 408A can include VNIDs 1 and 2,VTEP 408B can include VNIDs 1 and 3, VTEP 408C can include VNIDs 1 and2, and VTEP 408D can include VNIDs 1-3. As one of ordinary skill in theart will readily recognize, any particular VTEP can, in otherembodiments, have numerous VNIDs, including more than the 3 VNIDsillustrated in FIG. 4.

The traffic in overlay network 400 can be segregated logically accordingto specific VNIDs. This way, traffic intended for VNID 1 can be accessedby devices residing in VNID 1, while other devices residing in otherVNIDs (e.g., VNIDs 2 and 3) can be prevented from accessing suchtraffic. In other words, devices or endpoints connected to specificVNIDs can communicate with other devices or endpoints connected to thesame specific VNIDs, while traffic from separate VNIDs can be isolatedto prevent devices or endpoints in other specific VNIDs from accessingtraffic in different VNIDs.

Servers 404A-D and VMs 404E-I can connect to their respective VNID orvirtual segment, and communicate with other servers or VMs residing inthe same VNID or virtual segment. For example, server 404A cancommunicate with server 404C and VMs 404E and 404G because they allreside in the same VNID, viz., VNID 1. Similarly, server 404B cancommunicate with VMs 404F, 404H because they all reside in VNID 2. VMs404E-I can host virtual workloads, which can include applicationworkloads, resources, and services, for example. However, in some cases,servers 404A-D can similarly host virtual workloads through VMs hostedon the servers 404A-D. In this regard, various endpoints such as servers404A-D and VMs 404E-I may be also referred to as hosts. Moreover, eachof the servers 404A-D and VMs 404E-I can represent a single server orVM, but can also represent multiple servers or VMs, such as a cluster ofservers or VMs.

VTEPs 408A-D can encapsulate packets directed at the various VNIDs 1-3in the overlay network 400 according to the specific overlay protocolimplemented, such as VXLAN, so traffic can be properly transmitted tothe correct VNID and recipient(s). Moreover, when a switch, router, orother network device receives a packet to be transmitted to a recipientin the overlay network 400, it can analyze a routing table, also knownas a lookup table or an encapsulation table, to determine where suchpacket needs to be transmitted so the traffic reaches the appropriaterecipient. For example, if VTEP 408A receives a packet from endpoint404B that is intended for endpoint 404H, VTEP 408A can analyze a routingtable that maps the intended endpoint, endpoint 404H, to a specificswitch that is configured to handle communications intended for endpoint404H. VTEP 408A might not initially know, when it receives the packetfrom endpoint 404B, that such packet should be transmitted to VTEP 408Din order to reach endpoint 404H. Accordingly, by analyzing the routingtable, VTEP 408A can lookup endpoint 404H, which is the intendedrecipient, and determine that the packet should be transmitted to VTEP408D, as specified in the routing table based on endpoint-to-switchmappings or bindings, so the packet can be transmitted to, and receivedby, endpoint 404H as expected.

However, continuing with the previous example, in many instances, VTEP408A may analyze the routing table and fail to find any bindings ormappings associated with the intended recipient, e.g., endpoint 404H.Here, the routing table may not yet have learned routing informationregarding endpoint 404H. In this scenario, the VTEP 408A may likelybroadcast or multicast the packet to ensure the proper switch associatedwith endpoint 404H can receive the packet and further route it toendpoint 404H.

In some cases, the routing table can be dynamically and continuouslymodified by removing unnecessary or stale entries and adding new ornecessary entries, in order to maintain the routing table up-to-date,accurate, and efficient, while reducing or limiting the size of thetable.

As one of ordinary skill in the art will readily recognize, the examplesand technologies provided above are simply for clarity and explanationpurposes, and can include many additional concepts and variations.

FIG. 5 illustrates an example layout of an encapsulated packet.Encapsulated packet 500, such as a VXLAN encapsulated packet, mayconsist of original frame 502 combined with overlay networkencapsulation 504. Overlay network encapsulation 504 can be a header.Both original frame 502 and overlay network encapsulation header 504 mayconsist of component data segments or bits 506-526. However, one ofordinary skill in the art will recognize that the exact layout of thepacket may differ from the example layout 500 as shown in FIG. 5. Forexample, data segments 506-526 may be rearranged in a different order,one or more example data segments 506-526 may be omitted, and/or otherdata segment(s) not shown in FIG. 5 may be added to layout 500. Originalframe 502 may be an L2 packet such as an Ethernet frame. It may haveoriginal payload 510, which represents the actual data that the packetis tasked with transmitting from one node to another node in thenetwork. In an Ethernet packet, original payload 510 would be anoriginal Ethernet payload. Original frame 502 may include inner hostdestination address 506 and inner host source address 508, which mayrespectively represent layer 2 addresses, such as MAC addresses, of thedestination and source hosts (i.e., endpoints). Original frame 502 mayalso contain other data 512 such as cyclic redundancy check (CRC) codeor optional inner packet data according to the Institute of Electricaland Electronics Engineers (IEEE) 802.1Q standards.

Original frame 502 can be encapsulated at a tunnel endpoint, such asVTEPs 408A-408D as shown in FIG. 4, with overlay network encapsulationheader 504. After traversing the overlay network with a help of theinformation contained in overlay network encapsulation header 504,encapsulated packet 500 can then be de-encapsulated at another tunnelendpoint. Overlay network encapsulated packet 500 may be treated as a L3packet, such as a User Datagram Protocol (UDP) packet. Overlay networkencapsulation header 504 may contain one or more data segments, such asouter host destination address 514, outer host source address 516, outerIP destination address 518, outer IP source address 520, outer UDP 522,VNID 524, and other data 526. Outer host destination address 514 may bean L2 address, such as a MAC address, for the destination tunnelendpoint (e.g., VTEP). Similarly, outer host source address 516 may bean L2 address, such as a MAC address, for the source tunnel endpointthat encapsulated overlay network encapsulated packet 500. Outer IPdestination address 518 may be an L3 address, such as an IP address,attached to the destination tunnel endpoint. By the same token, outer IPsource address 520 may represent the L3 address, such as the IP address,for the source tunnel endpoint where packet 500 was encapsulated.

Outer UDP 522 may contain information pertaining to a specific L3protocol (e.g., UDP), such as a source port number, a destination portnumber, a length, a checksum, etc. However, one of ordinary skill in theart will readily recognize that data necessary for other types ofprotocols, such as TCP, may also be included depending on what type ofoverlay network the encapsulated packet is deployed in. VNID 524 mayinclude information about which segregated virtual network in theoverlay network the encapsulated packet pertains to. For example, in aVXLAN network, VNID 526 can be a 24-bit VXLAN ID. Other data 526 can beincluded in encapsulated packet 500 such as outer IEEE 802.1Q data.

FIG. 6 illustrates a schematic block diagram of example overlay network600 with access switches 602A, 602B functioning as proxies for tunnelendpoints 604A, 604B, 604C, 604E, 604F. In some embodiments, accessswitches 602A, 602B can be a physical switch. In other embodiments,access switches 602A, 602B can be a virtual or logical switch residingon a physical device. Access switches 602A, 602B may be a ToR switch.Access switches 602A, 602B can be connected, via their front panelports, to one or more tunnel endpoints 604A, 604B, 604C, 604E, 604F, andfunction as proxies for those tunnel endpoints 604A, 604B, 604C, 604E,604F. Moreover, access switches 602A, 602B themselves may have a VTEPcapability and have their tunnel endpoint addresses. For example, accessswitch 602A may proxy for VTEPs 604A, 604B, 604C. The example IPaddresses for VTEPs 604A, 604B, 604C are 10.1.1.1, 10.1.1.2, 10.1.1.3,and access switch 602A has its own IP address, 10.1.1.7. Similarly, inexample overlay network 600, access switch 602B with IP address 10.1.1.8functions as a proxy for VTEP 604E with IP address 10.1.1.5 and VTEP604F with IP address 10.1.1.6. Some VTEPs such as VTEP 604D may not bebehind an access switch, and such VTEP 604D can route messages to otheraccess switches 602A, 602B or VTEPs. VTEPs 604A-604F, in turn, may beconnected to one or more endpoints or hosts 606A-606G with VNIDs (notshown in FIG. 6) and L2 addresses such as MAC addresses. Hosts 606A-606Gcan be servers, VMs, terminals, clusters, etc.

As will be discussed in detail below, access switches 602A, 602B maytake ownership of the outbound encapsulated packets by replacing thesource tunnel endpoint addresses in the encapsulated packets with theirown tunnel endpoint addresses. For example, access switch 602A canrewrite the source tunnel address field, such as outer IP SA 520 datasegment of encapsulated packet 500 shown in FIG. 5, by inserting the IPaddress for access switch 602A (i.e., 10.1.1.7) to any of theencapsulated packets originating from hosts 606A-606C and encapsulatedat VTEPs 604A-604C. Subsequently, by the time the packets, eachoriginating from one of hosts 606A-606C and encapsulated at one of VTEPs604A-604C, pass through access switch 602A and arrive at other VTEP 604Dor access point 602B, the source tunnel endpoint address in thosepackets may only show up the IP address of access switch 602A (i.e.,10.1.1.7), instead of their original source tunnel endpoint addressessuch as 10.1.1.1, 10.1.1.2, or 10.1.1.3. Thus, once the source addresstranslation takes place, the rest of the network fabric may see the endpoints below access switch 602A as being attached to one tunnelendpoint, even though they may actually have their outbound packetsencapsulated at VTEPs 604A-604C below proxy switch 602A.

As proxies, access switches 602A, 602B can maintain the forwardinginformation for all the hosts that are reachable via their front panelports. The forwarding information may be stored in a routing table, alookup table, or an encapsulation table. In some embodiments, accessswitch 602A may maintain separate lookup tables for inbound traffic andoutbound traffic, while in other embodiments, access switch 602A may usethe same lookup table for both inbound and outbound traffic. Accessswitch 602A may also keep separate lookup tables for different VNIDsinstead of having a combined table for all the VNIDs.

FIG. 7 illustrates example encapsulation table 700 as used by tunnelendpoint 604C of FIG. 6 for encapsulating outbound packets.Encapsulation table 700, also known as a routing table or a lookuptable, may contain host address field 702, VNID field 704, and tunnelendpoint address field 706. One of ordinary skill in the art willreadily recognize that encapsulation table 700 can contain moreinformation or less information than what is presented in FIG. 7. Hostaddress field 702 may represent L2 addresses, such as MAC addresses, forendpoints in the overlay network. In addition, VNID field 704 maypresent the identifiers of the virtual networks, such as VXLANs, towhich the endpoints are assigned. Furthermore, tunnel endpoint addressfield 706 may list corresponding L3 addresses, such as IP addresses,that are associated with the hosts.

For instance, if VTEP 604C is to encapsulate a packet (e.g., L2 dataframe) that is destined for host 606F, VTEP 604C can extract thedestination host address, such as inner MAC DA 506 as shown in FIG. 5,from the packet, and look up that address in encapsulation table 700.Example lookup entry 708F in encapsulation table 700 indicates that thedestination host address 66:66:66:66:66:66 is linked to VNID of 3 andVTEP address of 10.1.1.8. Therefore, VTEP 604C may insert the IP address10.1.1.8 in the destination tunnel endpoint address field, such as outerIP DA 518 as shown in FIG. 5, of the encapsulation header.

Notice that VTEP addresses 706 for hosts 606F, 606G appear on exampleencapsulation table 700 as 10.1.1.8 (708F, 708G), which is the tunnelendpoint address associated with access switch 602B, instead of 10.1.1.5or 10.1.1.6, which corresponds to VTEP 604E and VTEP 604F respectively,because VTEPs 604E, 604F are located behind access switch 602B andtherefore hidden from VTEP's 604C view in example overlay network 600.Notice also that VTEP addresses 706 in encapsulation table 700 for theVTEPs that are behind an access switch (e.g., VTEPs 604E, 604F) may beindistinguishable from the VTEP addresses for those VTEPs that are notbehind an access switch (e.g., VTEP 604D). In other words, from thestandpoint of VTEP 604C, hosts 606F, 606G may simply appear as thoughthey are behind a single VTEP, not unlike how hosts 606D, 606E mayappear to VTEP 604C. VTEP 604C may not be able to determine whether agiven host is behind a proxy tunnel endpoint or not, just by examiningencapsulation table 700.

Optionally, encapsulation table 700 used by VTEP 604C may also contain alookup entry for host 606C that is attached to VTEP 604C (708C) andentries for hosts 606A, 606B that are attached to other VTEPs 604A, 604Bbehind the same access switch 602A as VTEP 604C (708A, 708B). Theselookup entries may be helpful for routing packets within VTEP and/oraccess switch boundaries or providing additional network features suchas security enforcement, service redirect, etc.

FIG. 8 illustrates a schematic block diagram of an example overlaynetwork with source address translation. In order to implement sourceaddress translation, an access switch may maintain associations betweenhosts and tunnel endpoints for all the hosts that are reachable via itsfront panel ports. When the access switch receives encapsulated trafficfrom their subsidiary tunnel endpoints, in addition to learning theactual associations between the hosts and the tunnel endpoints specifiedin the packet, it could also claim ownership of the source address byoverwriting the overlay IP source address with its own tunnel endpointaddress. With this source address translation mechanism, it may appearto other network devices in the overlay network as though all thosehosts have the access switch as their tunnel endpoint. In addition, byoverwriting the IP source address of the encapsulated packet on theegress path, the access switch may proxy for the tunnel endpoint in thenetwork such that any host movements below the access switch may not bevisible to other tunnel endpoints, hence significantly reducing theamount of updates needed for the lookup tables in those other tunnelendpoints. For example, even if host 606B were to migrate from VTEP 604Bto VTEP 604C, VTEP 604E need not update its routing table regarding host606B because host 606B would still be associated with the same IPaddress, namely the tunnel endpoint address for access switch 602A.

On the other hand, when the incoming traffic arrives at the accessswitch, the access switch can examine the inner host destination addressin the packet to determine how it may forward the packet. Moreover, ifthe packet is headed to a tunnel endpoint that is attached to the accessswitch's front panel port, the access switch can rewrite the overlay IPdestination address with the final tunnel endpoint address beforeforwarding the packet down to the local tunnel endpoint. In other words,by overwriting the IP source address of the encapsulated packet on theingress path, the access switch can proxy for all the tunnel endpointsbelow it such that other tunnel endpoints in the overlay network mayonly need to maintain the encapsulation information for access switches.Consequently, a hierarchy of overlay network encapsulations may beachieved. This allows the overlay network to advantageously supportsignificantly more number of tunnel endpoints across the fabric. In someembodiments, the overlay network hierarchy may be further layered byattaching one or more access switches to another access switch that mayfunction as a proxy for the other access switches below it.

As an example, an example packet originating from host 606C and destinedfor host 606F may traverse overlay network 800 while being encapsulated,translated, and de-encapsulated. The various components and contents ofthe packet will be illustrated in terms of example encapsulation layout500 of FIG. 5. First, an L2 packet, such as an Ethernet packet, isgenerated by host 606C. The packet may have the MAC address33:33:33:33:33:33 as its inner MAC source address 508 and66:66:66:66:66:66 as its inner MAC destination address 506. The maininformation that the packet is trying to deliver to host 606F may becontained in its Ethernet payload 510. Once host 606C generates thepacket, it forwards the packet to VTEP 604C (802A). VTEP 604C may thenperform MAC-in-UDP encapsulation on the packet by appending overlaynetwork encapsulation header 504, such as a VXLAN header, to the L2packet. VTEP 604C may first look up inner MAC destination address 506 ina lookup table, such as encapsulation table 700 as shown in FIG. 7, todetermine the destination tunnel endpoint address. In this example, thedestination tunnel endpoint address that is associated with host 606Fturns out to be 10.1.1.8. VTEP 604C can use this address as outer IPdestination address 518 and its own IP address, 10.1.1.3, as outer IPsource address 520. VTEP 604C may also insert its MAC address as outerMAC source address 516 and the MAC address for access switch 602B asouter MAC destination address 514.

Subsequently, VTEP 604C may forward the encapsulated packet to accessswitch 602A (802B). Upon receiving the encapsulated packet, accessswitch 602A may take ownership of the packet by performing sourceaddress translation on the packet. In other words, access switch 602Amay swap original outer IP source address 520 with its own IP address,which is 10.1.1.7. Thus, subsequent network nodes or terminals that mayreceive the translated packet may only recognize the translated packetas originating from access switch 602A and may not know of the existenceof its original encapsulating tunnel endpoint 604C. After inserting thetranslated source address, access switch 602A may transmit theencapsulated packet towards the packet's destination tunnel endpointaddress (i.e., 10.1.1.8) via network 402 (802C). The encapsulated packeteventually reaches access switch 602B via network 402 (802D).

Upon receiving the encapsulated packet from access switch 602A, accessswitch 602B may refer to its own lookup table to determine that the hostcorresponding to the destination host address (i.e., 66:66:66:66:66:66)is connected to VTEP 604E, which is located behind access switch 602B.In order to further route the packet to its intended destination, accessswitch 602B may perform another address translation step to swap outerIP destination address 518 with the IP address of VTEP 604E (i.e.,10.1.1.5). With the new destination tunnel endpoint address written inits header, the encapsulated packet may be forwarded by access switch602B to VTEP 604E (802E). Finally, VTEP 604E may de-encapsulate thepacket by removing encapsulation header 504, and forward the resultingL2 data frame to its final destination, host 606F (802F).

The source address translation process may be implemented by thefollowing example pseudo-code:

TABLE 1 Unicast case: #infra attach destination, unidestination packet... if EgrFields.EgrEncapValid: pkt.outer.DIP = EncapEntry.DIPpkt.outer.SMAC = self.EgrSrcEncap[EgrFields.Overlaylnst].SMACpkt.outer.SIP = self.EgrSrcEncap[EgrFields.Overlaylnst].SIPpkt.outer.VLAN = self.EgrSrcEncap[EgrFields.Overlaylnst].VLANpkt.outer.DMAC = self.Config.MAC

TABLE 2 Multicast case: # this is a multi-destination packet because #NMetPtr is not NULL need to walk through the # NMetTable after modifyingthe packet properly Done= False NMetPtr = EncapEntry.NMetPtr while notDone: #make a copy of the packet . . . #modify the packet headers ifEgrFields.EgrEncapValid: newpkt.outer.SMAC =self.EgrSrcEncap[Overlaylnst].SMAC newpkt.outer.SIP =self.EgrSrcEncap[Overlaylnst].SIP newpkt.outer.VLAN = self.EgrSrcEncap[Overlaylnst].VLAN

FIGS. 9A-C illustrate source address translation in an exampleencapsulated packet. In particular, in FIG. 9A, encapsulation packet900A may be the example packet from the previous example shown in FIG.8. Encapsulation packet 900A may consist of original frame 902A, outerIP destination address 906A, outer IP source address 908A, and othermiscellaneous data 910A. One of skill in the art will readily recognizethat the layout may be implemented in any other combination thereof,including combinations that exclude, add, or modify certain data bits.When VTEP 604C encapsulates original frame 902A with encapsulationheader 904A, tunnel endpoint 604C may insert its own tunnel endpointaddress 10.1.1.3 into outer IP source address field 908A. In addition,after consulting the lookup table, VTEP 604C may determine that the VTEPaddress associated with the recipient host is 10.1.1.8. Accordingly,VTEP 604C may insert that address into outer IP destination addressfield 906A.

FIG. 9B illustrates encapsulation packet 900B after it reaches accessswitch 602A and undergoes source address translation. In this example,outer IP source address 908B is replaced by 10.1.1.7, which is thetunnel endpoint IP address for access switch 602A. In this way, accessswitch 602A has taken ownership of the outbound traffic. FIG. 9Cillustrates encapsulation packet 900C after it is transmitted vianetwork 402 and received by access switch 602B. In order to furtherroute encapsulated packet 902C to its intended recipient (i.e., host606F), access switch 602B may look up the packet's destination hostaddress in the encapsulation table and determine that the host residesunder VTEP 604E. Access switch 602B may then rewrite the packet'soverlay destination IP address 906C with the tunnel endpoint IP addressof VTEP 604E, which is 10.1.1.5. Now encapsulated packet 900C may beappropriately routed to VTEP 604E.

Having disclosed some basic system components and concepts, thedisclosure now turns to the example method embodiments shown in FIGS.10-11. For the sake of clarity, the methods are described in terms ofsystem 110, as shown in FIG. 1, configured to practice the method.Alternatively, the methods can be practiced by system 200 as shown inFIG. 2A, computer system 250 as shown in FIG. 2B, or any of endpoints310 as shown in FIG. 3. The steps outlined herein are exemplary and canbe implemented in any combination thereof in any order, includingcombinations that exclude, add, or modify certain steps.

FIG. 10 illustrates an example method embodiment. First, system 110 mayreceive, at an access switch in an overlay network, an encapsulatedpacket from a tunnel endpoint in the overlay network, the encapsulatedpacket originating from a host associated with the tunnel endpoint andencapsulated at the tunnel endpoint with a first source tunnel endpointaddress and a destination tunnel endpoint address (1002). The overlaynetwork may be a VXLAN and the tunnel endpoint can be a VTEP. Theencapsulated packet may be an OSI layer 3 packet, such as a UDP packet,and the packet may be encapsulated at the tunnel endpoint usingMAC-in-UDP encapsulation. Moreover, the first source tunnel endpointaddress, the second source tunnel endpoint address, and the destinationtunnel endpoint address can be L3 addresses, such as IP addresses.System 110 can record, in a translation table at the access switch, anassociation between the host and the first source tunnel endpointaddress.

System 110 may then replace the first source tunnel endpoint address inthe encapsulated packet with a second source tunnel endpoint address ofthe access switch to yield a translated packet (1004). Then, system 110may transmit the translated packet from the access switch towards thedestination tunnel endpoint address (1006). In some embodiments, thedestination tunnel endpoint address may belong to another tunnelendpoint in the overlay network. In other embodiments, the destinationtunnel endpoint address may belong to another access switch in theoverlay network. The other access switch may be configured to forwardthe translated packet to a tunnel endpoint that is associated with thataccess switch.

Additionally, system 110 may receive, at the access switch, an incomingencapsulated packet that is destined for the host. The incomingencapsulated packet may have the second source tunnel endpoint addressin a destination tunnel endpoint address field. System 110 may determinethat the host is associated with the first source tunnel endpointaddress by using the translation table. System 110 may then rewrite thedestination tunnel endpoint address field in the incoming encapsulatedpacket with the first source tunnel endpoint address to yield anincoming translated packet. System 110 can transmit the incomingtranslated packet from the access switch to the tunnel endpoint.

FIG. 11 illustrates another example method embodiment. System 110 mayreceive, at an access switch in an overlay network, an encapsulatedpacket that is destined for a host (1102). The encapsulated packet mayhave a first destination tunnel endpoint address for the access switchand a destination host address for the host (1102). The firstdestination tunnel endpoint address may be an L3 address, such as an IPaddress, and the destination host address may be an L2 address, such asa MAC address. System 110 may determine that the host is associated witha tunnel endpoint by using a translation table that stores anassociation between the destination host address and a seconddestination tunnel endpoint address of the tunnel endpoint (1104). Thesecond destination tunnel endpoint may be an L3 address, such as an IPaddress. System can then replace the first destination tunnel endpointaddress in the encapsulated packet with the second destination tunnelendpoint address to yield a translated packet (1106). The translatedpacket may be an L3 packet, such as a UDP packet. System may transmitthe translated packet from the access switch to the tunnel endpoint(1108). The tunnel endpoint may be configured to de-encapsulate thetranslated packet to yield a de-encapsulated frame, and forward thede-encapsulated frame to the host. The de-encapsulated frame can be anL2 packet, such as a MAC frame.

For clarity of explanation, in some instances the present technology maybe presented as including individual functional blocks includingfunctional blocks comprising devices, device components, steps orroutines in a method embodied in software, or combinations of hardwareand software.

In some embodiments the computer-readable storage devices, mediums, andmemories can include a cable or wireless signal containing a bit streamand the like. However, when mentioned, non-transitory computer-readablestorage media expressly exclude media such as energy, carrier signals,electromagnetic waves, and signals per se.

Methods according to the above-described examples can be implementedusing computer-executable instructions that are stored or otherwiseavailable from computer readable media. Such instructions can comprise,for example, instructions and data which cause or otherwise configure ageneral purpose computer, special purpose computer, or special purposeprocessing device to perform a certain function or group of functions.Portions of computer resources used can be accessible over a network.The computer executable instructions may be, for example, binaries,intermediate format instructions such as assembly language, firmware, orsource code. Examples of computer-readable media that may be used tostore instructions, information used, and/or information created duringmethods according to described examples include magnetic or opticaldisks, flash memory, USB devices provided with non-volatile memory,networked storage devices, and so on.

Devices implementing methods according to these disclosures can comprisehardware, firmware and/or software, and can take any of a variety ofform factors. Typical examples of such form factors include laptops,smart phones, small form factor personal computers, personal digitalassistants, rackmount devices, standalone devices, and so on.Functionality described herein also can be embodied in peripherals oradd-in cards. Such functionality can also be implemented on a circuitboard among different chips or different processes executing in a singledevice, by way of further example.

The instructions, media for conveying such instructions, computingresources for executing them, and other structures for supporting suchcomputing resources are means for providing the functions described inthese disclosures.

Although a variety of examples and other information was used to explainaspects within the scope of the appended claims, no limitation of theclaims should be implied based on particular features or arrangements insuch examples, as one of ordinary skill would be able to use theseexamples to derive a wide variety of implementations. Further andalthough some subject matter may have been described in languagespecific to examples of structural features and/or method steps, it isto be understood that the subject matter defined in the appended claimsis not necessarily limited to these described features or acts. Forexample, such functionality can be distributed differently or performedin components other than those identified herein. Rather, the describedfeatures and steps are disclosed as examples of components of systemsand methods within the scope of the appended claims. Thus, the claimsare not intended to be limited to the aspects shown herein, but are tobe accorded the full scope consistent with the language claims, whereinreference to an element in the singular is not intended to mean “one andonly one” unless specifically so stated, but rather “one or more.”

A phrase such as an “aspect” does not imply that such aspect isessential to the subject technology or that such aspect applies to allconfigurations of the subject technology. A disclosure relating to anaspect may apply to all configurations, or one or more configurations. Aphrase such as an aspect may refer to one or more aspects and viceversa. A phrase such as a “configuration” does not imply that suchconfiguration is essential to the subject technology or that suchconfiguration applies to all configurations of the subject technology. Adisclosure relating to a configuration may apply to all configurations,or one or more configurations. A phrase such as a configuration mayrefer to one or more configurations and vice versa.

The word “exemplary” is used herein to mean “serving as an example orillustration.” Any aspect or design described herein as “exemplary” isnot necessarily to be construed as preferred or advantageous over otheraspects or designs. Moreover, claim language reciting “at least one of”a set indicates that one member of the set or multiple members of theset satisfy the claim.

We claim:
 1. A method comprising: receiving, at an access switch in anoverlay network, an encapsulated packet from a tunnel endpoint in theoverlay network, the encapsulated packet originating from a hostassociated with the tunnel endpoint and encapsulated at the tunnelendpoint with a first source tunnel endpoint address and a destinationtunnel endpoint address; replacing the first source tunnel endpointaddress in the encapsulated packet with a second source tunnel endpointaddress of the access switch to yield a translated packet; andtransmitting the translated packet from the access switch towards thedestination tunnel endpoint address.
 2. The method of claim 1, whereinthe first source tunnel endpoint address, the second source tunnelendpoint address, and the destination tunnel endpoint address areInternet protocol (IP) addresses.
 3. The method of claim 1, wherein thetunnel endpoint is a first tunnel endpoint, and wherein the destinationtunnel endpoint address belongs to a second tunnel endpoint in theoverlay network.
 4. The method of claim 1, wherein the tunnel endpointis a first tunnel endpoint and the access switch is a first accessswitch, and wherein the destination tunnel endpoint address belongs to asecond access switch in the overlay network, the second access switchbeing configured to forward the translated packet to a second tunnelendpoint associated with the second access switch.
 5. The method ofclaim 1, wherein the encapsulated packet is encapsulated at the tunnelendpoint by using media access control in user datagram protocol(MAC-in-UDP) encapsulation.
 6. The method of claim 1, wherein theoverlay network is a virtual extensible local area network (VXLAN) andthe tunnel endpoint is a virtual tunnel endpoint (VTEP).
 7. The methodof claim 1, further comprising: recording, in a translation table at theaccess switch, an association between the host and the first sourcetunnel endpoint address.
 8. The method of claim 7, the method furthercomprising: receiving, at the access switch, an incoming encapsulatedpacket being destined for the host, the incoming encapsulated packethaving the second source tunnel endpoint address in a destination tunnelendpoint address field; determining that the host is associated with thefirst source tunnel endpoint address by using the translation table;rewriting the destination tunnel endpoint address field in the incomingencapsulated packet with the first source tunnel endpoint address toyield an incoming translated packet; and transmitting the incomingtranslated packet from the access switch to the tunnel endpoint.
 9. Asystem comprising: a processor; and a computer-readable storage mediumhaving stored therein instructions which, when executed by theprocessor, cause the processor to perform operations comprising:receiving, at an access switch in an overlay network, an encapsulatedpacket from a tunnel endpoint in the overlay network, the encapsulatedpacket originating from a host associated with the tunnel endpoint andencapsulated at the tunnel endpoint with a first source tunnel endpointaddress and a destination tunnel endpoint address; replacing the firstsource tunnel endpoint address in the encapsulated packet with a secondsource tunnel endpoint address of the access switch to yield atranslated packet; and transmitting the translated packet from theaccess switch towards the destination tunnel endpoint address.
 10. Thesystem of claim 9, wherein the first source tunnel endpoint address, thesecond source tunnel endpoint address, and the destination tunnelendpoint address are Internet protocol (IP) addresses.
 11. The system ofclaim 9, wherein the tunnel endpoint is a first tunnel endpoint, andwherein the destination tunnel endpoint address belongs to a secondtunnel endpoint in the overlay network.
 12. The system of claim 9,wherein the tunnel endpoint is a first tunnel endpoint and the accessswitch is a first access switch, and wherein the destination tunnelendpoint address belongs to a second access switch in the overlaynetwork, the second access switch being configured to forward thetranslated packet to a second tunnel endpoint associated with the secondaccess switch.
 13. The system of claim 9, wherein the encapsulatedpacket is encapsulated at the tunnel endpoint by using media accesscontrol in user datagram protocol (MAC-in-UDP) encapsulation.
 14. Thesystem of claim 9, wherein the overlay network is a virtual extensiblelocal area network (VXLAN) and the tunnel endpoint is a virtual tunnelendpoint (VTEP).
 15. The system of claim 9, the computer-readablestorage medium storing additional instructions which, when executed bythe processor, cause the processor to perform a further operationcomprising: recording, in a translation table at the access switch, anassociation between the host and the first source tunnel endpointaddress.
 16. The system of claim 15, the computer-readable storagemedium storing additional instructions which, when executed by theprocessor, cause the processor to perform further operations comprising:receiving, at the access switch, an incoming encapsulated packet beingdestined for the host, the incoming encapsulated packet having thesecond source tunnel endpoint address in a destination tunnel endpointaddress field; determining that the host is associated with the firstsource tunnel endpoint address by using the translation table; rewritingthe destination tunnel endpoint address field in the incomingencapsulated packet with the first source tunnel endpoint address toyield an incoming translated packet; and transmitting the incomingtranslated packet from the access switch to the tunnel endpoint.
 17. Anon-transitory computer-readable storage medium having stored thereininstructions which, when executed by a processor, cause the processor toperform operations comprising: receiving, at an access switch in anoverlay network, an encapsulated packet being destined for a host, theencapsulated packet having a first destination tunnel endpoint addressfor the access switch and a destination host address for the host;determining that the host is associated with a tunnel endpoint by usinga translation table that stores an association between the destinationhost address and a second destination tunnel endpoint address of thetunnel endpoint; replacing the first destination tunnel endpoint addressin the encapsulated packet with the second destination tunnel endpointaddress to yield a translated packet; and transmitting the translatedpacket from the access switch to the tunnel endpoint.
 18. Thenon-transitory computer-readable storage medium of claim 17, wherein thefirst destination tunnel endpoint address and the second destinationtunnel endpoint are IP addresses, and the destination host address is amedia access control (MAC) address.
 19. The non-transitorycomputer-readable storage medium of claim 17, wherein the tunnelendpoint is configured to de-encapsulate the translated packet to yielda de-encapsulated frame and forward the de-encapsulated frame to thehost.
 20. The non-transitory computer-readable storage medium of claim19, wherein the translated packet is a UDP packet and thede-encapsulated frame is a MAC frame.